Document Data Release date: Number of pages: Version: 7 August 2018 11 3.1 Version: 3.1 I Page 1/11
Table of Contents 1 Policies and Procedures... 4 1.1 Information Security Management... 4 1.2 Human Resources and Education... 4 1. 3 Access Control... 4 1.4 Production Monitoring... 4 1.5 Design and Development Standards... 5 1.6 ghtrack Development Stack... 5 1.7 Coding Standards... 5 2 Hosting Services and Data Policy... 5 2.1 Hosting Service Provider... 5 2.2 Infrastructure... 5 2.3 No-Direct-Data Access Policy... 5 2.4 Data Access in Case of Unforeseeable Events... 6 2.5 Hosting Service Security Certificates and Standards... 6 2.6 ghtrack Data and Hosting Location... 6 3 System Availability... 7 3.1 Service and/or Database Failure... 7 3.2 Data Backup... 7 3.3 Server Failure... 7 4 Infrastructure Security... 7 4.1 Threat Management... 7 4.2 Network Connection... 8 4.3 Segregation of Testing Environment... 8 4.4 Release of New Versions... 8 4.5 Logging, Monitoring, and Reporting... 8 5 ghtrack Operation and User Security... 8 5.1 Communication Encryption... 8 5.2 General User Security... 9 5.3 Authentication... 9 5.4 User Password Standard... 9 5.5 Password Protection Policy... 9 5.6 Access Logging... 10 5.7 Audit and Transaction Logging... 10 5.8 Deletion of Data... 10 Version: 3.1 I Page 2/11
6 Breach of Security... 11 ghtrack Purpose The ghtrack service strives to achieve a high degree of data and communication security as sensitive information may be stored in relation to the usage of ghtrack. To ensure all stakeholders of ghtrack that adequate security measures have been implemented, this document clarifies exactly which measures have been taken in design and production of ghtrack - in relation to data-storage, - backup, -security, -privacy, and international and country-specific regulations, which have to be complied with when handling personal identifiable information or other sensitive telematics related data. Application This statement applies to all actors and users of the ghtrack service as a whole. ghtrack is owned, developed, and maintained by the Group, under which (VAT No: DK37439541) 1 is an independent legal entity. Group is the copyright owner of ghtrack. All users of ghtrack are direct customers of and shall therefore only be bound to user agreements with and its general terms and conditions. Terms Customer ghtrack GSH May PII PQM Shall or must Should Used to describe a legal entity, which submits data into or extracts data from the ghtrack service. Data-as-a-service with multiple service modules. General Security Handbook - Security handbook for employees for handling general security related issues; not for public distribution. Used to describe a permissible way to achieve compliance. Personal Identifiable Information - this also includes positional information, license plates etc. Process & Quality Management - 's quality management system certified according to DS/EN ISO 9001:2015 2 ; not for public distribution. Compliance is mandatory. Compliance is recommended, but not mandatory. 1 http://www.gatehouse.dk/logistics/ 2 is DS/EN ISO 9001:2015 certified for the following product or service ranges: "Development of customer specific software solutions. Service provision, support and maintenance of mission critical communication systems. Consultancy within communication systems and equipment." Version: 3.1 I Page 3/11
User Used to describe a person which has a user profile on the ghtrack service. 1 Policies and Procedures 1.1 Information Security Management A/5 has a GSH which state how information security shall be managed within A/5. This covers not only general internal information security, but product and service specific information security as well, such as those regarding the ghtrack service and ghtrack's customers and users. The GSH specifies how all employees should conform to information security and data management for customers/users, and is influenced by the FKOBST 358-! 3. 1.2 Human Resources and Education All personnel that have access to, or administrate production environments, which contain PII, are educated in the concepts of information security and relevant technologies and must adhere to all relevant security processes within A/5. Only employees who have been certified by COO can gain access to perform administrative operations on production environments for ghtrack. This however, does not enable employees to gain direct access to any PII. 1.3 Access Control Access to any security critical part of the ghtrack service backend, such as databases, backup or other production environments, are only provided to specific employees on a need-to-know basis. Access to each of these systems is handled in coherence with the internal information security management according to GSH. 1.4 Production Monitoring All production systems and servers are monitored for malicious activity and maintained accordingly - both manually and via automatic monitoring. Access logs to servers, and production service environments are reviewed accordingly. 3 https://fe-ddis.dk/sitecollectiondocuments/fe/militaersikkerhed/fkobst358-1.pdf Version: 3.1 I Page 4/11
1.5 Design and Development Standards ghtrack is designed and developed in conformance with our PQM, which is DS/EN ISO 9001: 2008 certified and is influenced by CMMI L3. 1.6 ghtrack Development Stack ghtrack is primarily coded in C++, Java, JavaScript and PostgreSQL. Application and database management systems run on a mix of Linux and Windows servers. Furthermore, ghtrack utilize managed cloud services. 1.7 Coding Standards Development and software programming is performed according to internal PQM approved development standards and source code style guide. All production code is subject to regular code inspection/review and testing. 2 Hosting Services and Data Policy 2.1 Hosting Service Provider uses one or several cloud service provider(s) for the ghtrack service. Such cloud service provider(s) are bound by a data controller privacy policy agreement with A/S, which prohibits the cloud service provider(s) to observe, or provide, any information or data in relation to ghtrack to third parties. 2.2 Infrastructure All data, and production environments for ghtrack are stored and hosted on A/S's private and secure cloud services within the cloud service partner(s) server. No third party has access to any data on hosting services. 2.3 No-Direct-Data Access Policy has designed ghtrack to adhere to a "No-Direct-Data Access Policy". This means that ghtrack cannot be used by administrative staff, in any way, to access any customer PII data. This includes e.g. direct database queries, direct backend access, or frontend manipulation. In any case, data owner is always responsible for giving permission to those Version: 3.1 I Page 5/11
customers who should be able to view/access their data, which can only be done via the ghtrack service itself. 2.4 Data Access in Case of Unforeseeable Events As long as A/5 has legal ownership of ghtrack and its production environments and hosting services, ghtrack customers shall be able to access their data via the ghtrack service. Only upon special requests can data be acquired directly from A/5, i.e. if data cannot be acquired from ghtrack. In the case where A/5 is no longer an established legal identity, or a business organization of any sort which allows A/5 to maintain or withhold ghtrack and its data as described within this document and ghtrack license agreements will release a formal notice to all ghtrack users to inform them of the specific circumstances and why they have unfolded. However, these procedures do not unfold if another legal identity accepts, or overtakes the legal data responsibilities of A/5 in regards to ghtrack and its customer's data - in this case, all ghtrack customers will be informed beforehand. 2.5 Hosting Service Security Certificates and Standards A/5 only uses professional cloud service partners certified under international and industry-specific standards such as: 150:27001, ISO 27017, ISO 27018, ISO 9001:2015, CS (DE), and Cyber Essentials Plus (UK). 2.6 ghtrack Data and Hosting Location All data in relation to ghtrack is stored on secured hardware located within the EU. A/5 highly values its customers' data privacy and security, and therefore highlights that information such as a physical street address or housing of data servers is nonrelevant in this case of data privacy and security and will only be regarded as a security-risk if revealed. Due to the fact that A/5 is a legal identity within the kingdom of Denmark, A/5 must conform to Danish and EU laws and regulations regarding data privacy and data control, hereunder the Danish Act on Processing of Personal Data 4 According to both the Danish Data Protection Agency (Datatilsynet) 5 and the Danish Act on Security and 4 https: //www. datatil synet. d k/ eng I ish/the-act-on-processi no-of-persona 1-d ata/read-the-act-on-p rocessi no-of-persona 1- data/ comp i led-version-of-the-act-on-processing-of-persona I-data/ 5 Danish Data Protection Agency, please see http://www.datatilsynet.dk/ Version: 3.1 I Page 6/11
Protection of PII, which are handled by public legal identities (Sikkerhedsbekendtg0relsen) 6, it is NOT required by data controllers/processors such as to reveal more detailed information of physical addresses of data service providers and data servers, other than country or city/state specifics. 3 System Availability 3.1 Service and/or Database Failure ghtrack makes use of multiple services to serve/store data to/from customers, such that if any server becomes unavailable the system will be able to operate without inconvenience or any loss of data. 3.2 Data Backup Backup of data stored in databases is performed regularly such that data can be restored in case of any critical failures. Backup is performed by multiple machines, where data is continuously replicated multiple times 24/7/365. In addition, continuous file system backups are made on all data and stored separately. All backup data, and backup to any services used by ghtrack is kept within the geographical location of the EU. 3.3 Server Failure If a server becomes unavailable, the ghtrack personnel is immediately notified such that a resolution can be found as quickly as possible. Server failures should not affect performance of the ghtrack service and users should in most cases not be affected by any server failures - see 3.1 and 3.2. 4 Infrastructure Security 4.1 Threat Management 's cloud service partner(s) provides threat management in relation to hosted services, and as such ghtrack and the underlying network used to link ghtrack services together is subject to threat management. 6 Danish Act no. 528 since 15/06/2000 with changes (no. 201 since 22/03/2001) - Sikkerhedsbekendtg0relsen, please see https://www.retsinformation.dk/forms/r0710.aspx?id=842 Version: 3.1 I Page 7/11
4.2 Network Connection The servers running ghtrack services are locked on all ports except for the ones used by the system internally, and only accepts requests from the internal service IP addresses. The public webinterface servers only accept connections on port 443 (HTTPS) and port 80 (HTTP), however access on HTTP shall always redirect to HTTPS in order to ensure full network encryption between all services and ghtrack customers and users. 4.3 Segregation of Testing Environment All new system functionality and design changes are verified and validated according to A/S PQM in a separate testing environment fully separated from the actual ghtrack production environment before being made available to the public production environments. 4.4 Release of New Versions For every new ghtrack version rollout, all users of ghtrack are informed of the specifics and the time and date when a new release shall be rolled out. In most cases, a version rollout should not affect users in critical ways. If such critical releases are required, all users will be informed of the specifics timely, in order to prepare for any inconvenience which, they might experience. 4.5 Logging, Monitoring, and Reporting Access to any services hosted by 's cloud service partner(s) is subject to audit logging and as such all attempts to access any servers used by ghtrack are logged for security analysis and monitoring. Any server failure is automatically reported to the ghtrack operational personnel as well. s ghtrack Operation and User Security 5.1 Communication Encryption All communication between users of ghtrack and the ghtrack service itself is encrypted with use of the Secure Socket Layer (SSL) and Transport Layer Security (TLS) technologies, which ensures that ALL data sent between users and the ghtrack service is obscured from outside parties. Furthermore, SSL and TLS makes use of data encryption and server verification, which implies that data only can be interpreted by the intended parties. The ghtrack system is split into different entities to ensure availability. All communication between the internal entities of ghtrack is performed via secure connections as well, such that data may not be interpreted by third parties during internal system Version: 3.1 I Page 8/11
communication. All encryption standard for ghtrack, for both communication and data encryption, is at minimum AES-256 (i.e. the AES algorithm using 256 bit keys). 5.2 General User Security In order to collect and view data, users must create a user account with an associated strong password, which shall be used to authenticate with the service. Users shall provide at least the following information and accept our usage terms before being able to authenticate against ghtrack. Full Name Username Password E-mail address Company CVR User name to login is used as a unique identifier for user profiles. User sessions will in special cases timeout and must be reestablished by the user. 5.3 Authentication To access any data through the API (DaaS), a user must be authenticated by an API key autogenerated by ghtrack. 5.4 User Password Standard ghtrack requires user passwords to conform to a high level of password security to limit the possibility of brute-force attacks. Passwords cannot be recovered in clear text and do require users to create new passwords in case of a lost password. ghtrack's password policy is strict, and every user must define a password which comply with the following rules: 1. Eight characters long 2. One upper and one lower case character 3. One number 4. One special character 5.5 Password Protection Policy Even though security measures are employed with regards to passwords, users are still responsible for defining their own secure passwords, and not sharing their passwords with anyone. A/5 recommends individual organizations to conform with the 15O/IEC 27001/27002 Version: 3.1 I Page 9/11
standard, regarding information security management. ghtrack does not require users to change their passwords, but as a recommendation they should be changed regularly for security measures. 5.6 Access Logging All non-successful authentication and unauthorized requests tries are logged within the system and are only accessible by ghtrack system administrators. These access logs are reviewed regularly as described in 1.4. If suspicious activity is noted, the specific user profiles will be analyzed in detail and the owner of the user profile will be contacted and/or the account will be deleted. 5.7 Audit and Transaction Logging All critical actions performed by users of ghtrack are logged both in relation to general operations (e.g. user creation/edit) and data specific operations. Audit logging ensures that all operations performed by users can be traced. The audit/transaction logs contain information about the following: 1. User which performed the operation 2. Time/date of operation 3. What information was changed or which operation was performed 4. Old information values (if applicable) 5. New information values (if applicable) System specific logs are kept indefinitely and always accessible by ghtrack administrative staff. 5.8 Deletion of Data Telematics data and its logs are kept in memory for 14 days and hereafter deleted. Only data constituting a specific tour or data from equipment explicitly tagged as permanent tracked is stored within ghtrack and forwarded to customers according to the data sharing agreements between the data provider and. Stored telematics data and its logs are securely kept for a period of 180 days within ghtrack, unless specific considerations requires otherwise. The data owner can explicitly request for data deletion (database deletion). The data owner is always entitled to database deletion unless such deletion is prohibited by applicable law or by an agreement. When a data owner requests for data to be deleted, ghtrack registers a "delete date" - which shall be no later than 10 days after delete request is made. After 10 days, the data is deleted completely from all ghtrack production services and the data owner is informed of successful deletion. Any Version: 3.1 I Page 10/11
backups of the data are kept for maximum 7 days after the data has been deleted (see why in 3.3). Afterwards, data cannot be recovered in ANY way. A/5 has verified and validated this deletion method. 6 Breach of Security A/5 incorporates the newest technologies for secure computing and data storage in cooperation with cloud service partners. However, data transmission over the internet and data storage can never be guaranteed 100% secure. As such, if a security breach should occur, the affected customers/users of ghtrack will be informed via personal e-mail sent to each individual customer/user. If customers do not respond to this formal notice within 3 calendar days, contact will be taken via telephone. A formal notice will contain the type of security breach the system was subject to and what measures have been taken to ensure minimal data breach. In addition, A/5 will inform all users of which actions to take to minimize any risk of inconvenience. All security breach incidents are reported and documented in a standardized way, as described in A/5 internal security management procedures, GSH. Missing Information? If you have any questions regarding security, data privacy, or technical documentation, you are always welcome to contact us via: support@gatehouse.dk Version: 3.1 I Page 11/11